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Section  I  . 


THE  ROLE  OF  THE  SAFETY  FUNCTION 


"What  is  the  purpose  or  objective  of  the  safety  function? 
is  certainly  the  most  basic  question  the  safety  manager  must 
answer.  Although  it  is  basic,  there  is  by  no  means  universal 
understanding  or  agreement  within  the  ranks  of  Army  safety 
professionals  regarding  the  role  of  the  Army  safety  program. 
AR  385-10  does  contain  an  explicit  set  of  goal  and  objective 
statements  that  provide  definitive  guidance.  This  guidance 
is  quoted  in  figure  1. 


FIGURE  1 


The  Goal 

Para  l-4a,  AR  385-10: 

Reduce  and  keep  to  a  minimum  accidental  manpower  and 
monetary  losses,  thus  providing  more  efficient  use  of 
resources  and  advancing  the  combat  e f f e c t iven s s s  of  the 

Army  . 

Para  l-4b,  AR  385-10: 

Provide  a  safe  and  healthful  environment  at  all  times 
for  all  Army  personnel  and  others  exposed  at  Army 
operations . 


The  Objectives 

Para  l-5a,  AR  385-10: 

Prevention  of  injury  and  occupational  illness  minimizes 
frequency  and  severity  of  injuries  and  occupational  i 
nesses  resulting  from  Army  operations.  It  thus  improves 
employee  morale  and  efficiency  and  minimizes  the  cost 
*  associated  with  loss  production  compensation  payments, 

sick  leave  usage,  and  other  related  expenses. 

^  Para  l-5b,  AR  385-10: 

Damage  control  aims  at  detecting  and  eliminating  the ^ 
causes  of  preventable,  inadvertent  damage  to  Army  and 
non-Army  property  as  a  result  of  Army  operations. 
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Para  l-5c,  AR  385-10: 

Accident  prevention  involves  the  use  of  special  techniques 
to  detect  unsafe  behavior  and  conditions  and  prevent  acci¬ 
dents  . 


Para  l-5d,  AR  385-10: 

Compliance  with  statutory  and  regulatory  requirements  uses 
the  specialized  experience  of  the  safety  staff  to  ensure 
consistent,  economical  compliance  with  applicable  safety 
requirements  of  Federal  statutes,  Army  regulations,  host 
nation,  and  Status  of  Forces  Agreements. 


Para  l-5e,  AR  385-10: 

Liability  limitation  involves  prompt  and  prudent  action 
to  reduce  the  likelihood  of  liability  against  the  Army. 


Para  l-5f,  AR  385-10: 

Occupational  health  involves  implementing  AR  40-5  to  ensure 
the  physical  and  mental  health  of  all  personnel  in  coopera¬ 
tion  with  safety  personnel. 


These  objectives  were  not  selected  by  random  chance.  They 
were  derived  from  analysis  of  the  Army's  mission  and  of  the  ( 

contribution  the  safety  program  can  make  to  this  mission.  ( 

Figure  1  depicts  the  Army  commander's  six  basic  missions  and 
shows  where  each  safety  program  objective  makes  its  contribu¬ 
tion.  It  is  interesting  to  note  how  significant  the  safety  J 

contribution  is  to  the  varied  aspects  of  the  command  mission.  { 

In  terms  of  mission  support,  the  output  of  each  of  the  safety  *, 

program  outputs  is  highly  significant  considered  against  the 
contribution  of  other  staff  sections.  Appendix  A  contains  the  t 

objectives  developed  into  an  overall  outline  including  goal  f 

statements,  tasks,  and  tactics.  The  significance  of  a  multi¬ 
output  program  of  this  character  in  terms  of  command  visibility,  I 

prestige,  etc.  should  not  be  underestimated.  , 


Section  II.  UNDERSTANDING  ACCIDENT  CAUSATION 

1.  AN  HISTORICAL  VIEW  OF  ACCIDENT  CAUSATION.  In  order  to 
successfully  design  and  manage  an  effective  accident  pre¬ 
vention  program,  it  is  first  necessary  to  understand  what ^ 
causes  accidents.  The  unexplained,  hurtful  happenings  which 
are  now  referred  to  as  accidents  probably  concerned  primi¬ 
tive  man  also.  An  early  tribesman  walking  through  the  for¬ 
est  who  had  a  tree  limb  fall  on  his  head  and  give  him  a 
painful  bump  could  only  rationalize  that,  for  some  reason, 
the  tree  spirit  was  angry  with  him  and  was  punishing  him. 

The  primitive  man  would  then  try  to  think  of  something  nice 
he  could  do  for  the  tree  spirit  so  that  the  tree  would  no 
longer  be  angry  with  him.  For  many  centuries  this  approach 
was  predominant.  Later  a  little  more  sophisticated  view  was 
accepted  — the  person  injured  was  somehow  at  fault.  He  was 
at  fault  because  he  should  be  "punished"  or  because  he  was 
"careless"  or  because  he  was  "stupid."  Whatever  rationale 
there  was  behind  the  explanation,  it  centered  on  the  person 
injured;  on  the  fact  that  he  could  have  avoided  it  with  some 
sort  of  action  on  his  part. 

a.  During  the  early  industrial  revolution  workers  who 
were  injured  in  factories,  so  reasoned  factory  managers, 
were  hurt  because  they  weren't  "careful."  That  was  a  com¬ 
fortable  approach  for  managers  to  take  because  it  was  ob¬ 
viously  unnecessary  for  them  to  do  anything  about  accidents 
since  it  was  up  to  people  to  protect  themselves.  Accidents 
were  considered  a  natural  side  effect  of  production  and  there 
was  no  need  to  worry  about  them  since,  as  everyone  knew, 
there  was  no  way  to  change  human  nature--people  always  ha 
been  and  always  would  be  careless. 


FIGURE  2 
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b.  This  view  of  individual  responsibility  for  safety  in 
the  industrial  setting  was  upheld  to  a  large  extent  in  the 
courts  — there  were  no  laws  forcing  compensation  pay  unless 
the  unjured  worker  sued  his  employer  and  actually  won.  Win¬ 
ning  was  also  rather  rare  for  an  injured  worker  because, 
under  the  common  law  of  the  time,  the  employer  had  to  be 
found  completely  to  blame  for  negligence.  But  public  opin¬ 
ion  began  to  rise  against  the  "worker-alone-is-to-blame" 
theory  and  the  courts  gradually  responded  by  being  more  re¬ 
sponsive  to  workers'  claims.  State  legislatures  began  to 
follow  suit  and  enact  laws  which  placed  more  and  more  finan¬ 
cial  responsibility  upon  the  employer  of  an  injured  worker; 
every  State  had  an  employer's  liability  law  by  1908. 

c.  Employers  who  would  have  financial  responsibility 
for  an  injured  worker  began  to  see  that,  financially  at 
least,  it  would  be  worth  their  while  to  prevent  accidents  if 
possible  rather  than  pay  for  them.  Since  there  was  no  or¬ 
ganized  theory  of  what  causes  accidents,  other  than  personal 
carelessness  on  the  part  of  the  worker,  there  was  no  organ¬ 
ized  plan  by  employers  on  how  to  prevent  accidents.  Indi¬ 
vidual  businesses  and  factories  used  a  hit-or-miss  kind  of 
effort  in  designing  a  safety  program.  Most  of  these  efforts 
were  ineffective  in  varying  degrees. 


2.  THE  HEINRICH  THEORY.  Into  this  mish-mash  of  disordered 
accident  prevention  stepped  a  man  named  H.  W.  Heinrich  who, 
in  1931,  published  a  book  called  "Industrial  Accident  Pre¬ 
vention,  A  Scientific  Approach."  Since  the  Heinrich  model 
of  accident  causation  has  been  the  basic  approach  in  acci¬ 
dent  prevention  and  has  been  used  mostly  by  safety  societies 
and  professional  people  since  its  publication  in  1931,  it  is 
necessary  to  take  a  fairly  indepth  look  at  this  "scientific 
approach . " 


FIGURE  3 
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a.  Heinrich  began  with  the  fact  of  injury  and  traced  it 
back  to  its  causes  (figure  3,  read  from  right  to  left).  An 
injury,  he  reasoned,  was  caused  by  an  accident,  and  an  acci 
dent  was  caused  by  either  an  unsafe  act  on  the  part  of  the 
injured  person  o_r  an  unsafe  condition  in  the  environment. 

This  was  a  major  breakthrough  in  the  safety  profession  be¬ 
cause  it  removed  some  of  the  blame  from  an  individual  worker. 
An  accident  might  indeed  be  caused  because  a  worker  was 
"careless"  but  it  might  also  have  been  caused  because  the 
machine  the  worker  was  given  to  work  with  was  poorly  designed 
or  maintained  and  therefore  made  it  likely  that  whoever  worked 
with  it  would  be  injured. 

b.  Managers  could  see  the  rationale  behind  this  theory-- 
it  made  sense  to  them  and  they  jumped  on  the  bandwagon.  Since 
one  of  Mr.  Heinrich's  remedies  against  accidents  had  to  do 
with  "things"  instead  of  people,  this  gave  employers  some¬ 
thing  concrete  to  correct.  Machines  and  business  and  fac¬ 
tory  layouts  were  looked  at  with  a  new  eye  and  were  found 

to  be  sadly  lacking  in  safety  features.  A  big  push  began  to 
engineer  for  safety.  This  engineering  for  safety  has  been 
marvelously  effective  and  is  still  a  big  area  of  safety 
responsibility  under  the  new  Occupational  Safety  and  Health 
Act  (OSHA). 

c.  However,  engineering  out  unsafe  conditions  was  only 

part  of  Mr.  Heinrich's  corrective  action  sequence.  The 
other  three  were:  instruction,  in  which  workers  were  taught 

how  to  do  their  particular  job  safely;  persuasion  and  appeal, 
in  which  people  were  exhorted  to  behave  safely  and  which 
prompted  all  those  reams  of  paper  being  used  for  posters; 
and  discipline,  in  which,  when  all  else  has  failed,  a  worker 
was  threatened  with  loss  of  money  or  job  if  his  safety  per 
formance  did  not  improve.  From  these  corrective  actions  of 
Heinrich's  have  come  the  famous  three  E  s  of  accident 
prevention :  Engineering,  Education,  and  Enforcement. 

Basically,  every  branch  of  the  safety  profession  designs  and 
manages  their  safety  efforts  along  these  lines  engineer  for 
safety,  educate  the  worker,  and,  when  nothing  else  works, 
enforce  penalties  against  wrong-doers. 

d.  Although  Mr.  Heinrich  had  taken  a  giant  step  forward 
by  developing  a  model  of  accident  causation  and  by  recognizing 
the  importance  of  unsafe  conditions  as  accident  causative 
factors,  still  the  major  and  supposedly  uncorrectable  fault 
for  accidents  was  left  resting  firmly  on  the  individual  and 
his  careless  unsafe  act.  The  next  step  back  in  Heinrich  s 
accident  causation  model  again  places  blame  squarely  on  the 
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individual  and  then,  in  the  next  step,  makes  a  vague  reference 
to  the  person's  social  environment  and  ancestry  as  the  causa¬ 
tion  reason  for  his  "carelessness"  or  fault.  Since  managers 
then  and  now  realize  full  well  that  there  wasn’t  a  whole  lot 
that  could  be  done  about  a  worker's  social  environment  and 
ancestry,  they  were  left  with  aiming  corrective  action  at 
those  points  on  Heinrich's  model  which  could  reasonably  be 
expected  to  yield  some  results,  especially  on  the  unsafe 
act/unsafe  condition  block. 

e.  Until  very  recently,  the  Heinrich  theory  of  accident 
causation  was  the  only  well-known,  workable  theory  upon  which 
to  base  a  safety  program.  And  stepping  as  it  did  into  a  vast 
wasteland  of  hit-or-miss  safety  effort,  it  was  very  effective 
Injury  rates  did  drop  drastically  for  many  years;  recently 
rates  have  again  begun  to  creep  up.  Because  of  this  slow 
but  steady  increase  in  the  number  of  accidents  and  injuries, 
it  is  perhaps  time  to  develop  a  new  causation  model  of  acci¬ 
dents  and  to  redesign  our  safety  efforts  around  a  more  viable 
causation  model. 


3.  A  NEW  ACCIDENT  CAUSATION  CONCEPT.  The  Department  of  the 
Army  has  developed  an  accident  causation  model  that  does  a 
better  job  of  depicting  the  causes  of  accidents.  It  is  a 
little  more  complicated  than  Heinrich's  model,  but  I  think 
we  can  demonstrate  that  it  does  a  lot  more  for  us  in  helping 
us  to  understand  how  accidents  are  caused  and  how  to  correct 
those  causes.  We  are  interested  in  your  comments. 

Note  below  that  what  Heinrich  identified  as  INJURY  has  been 
called  RESULT,  indicating  that  it  can  involve  damage  as  well 
as  personal  injury  and  that  the  result  can  range  from  the 
very  minor  to  the  very  severe.  The  term  MISHAP  has  been 
used  rather  than  Heinrich's  ACCIDENT  to  avoid  the  popular 
misunderstanding  that  an  accident  necessarily  involves 
injury  or  damage.  Finally,  the  term  OPERATING  ERROR  has 
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been  substituted  for  UNSAFE  ACT  &  UNSAFE  CONDITION  to  better 
reflect  the  fact  that  both  are  essentially  the  same  thing, 
resulting  from  mistakes  made  by  individuals. 

The  Department  of  the  Army  causation  model  parallels  Heinrich's 
to  this  point,  changing  only  a  few  items  to  improve  understanding. 
Examples  of  operating  errors  include: 

a.  Taking  an  unsafe  position. 

b.  Stacking  supplies  in  unstable  stacks. 

c.  Poor  housekeeping. 

d.  Removing  a  guard. 

The  Causes  of  Operating  Errors 

It  is  here,  when  we  add  the  consideration  of  systems  defects, 
that  we  break  away  from  Heinrich  and  add  a  concept  that  vir¬ 
tually  revolutionizes  accident  prevention  work.  We  believe 
this  key  concept,  developed  primarily  by  Mr.  William  C.  Pope, 
is  the  single  most  important  concept  yet  developed  in  accident 
prevention  theory.  It  changes  what  we  seek  to  do  and  how  we 
do  it  . 


but  more  importantly,  they 
occur  because  of 

SYSTEMS  DEFECTS 

FIGURE  5 
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WHAT  IS  A  SYSTEM  DEFECT? 


System  defects  are  weaknesses  in  the  way  the  system  is  designed 
or  operated.  Typical  examples  of  systems  defects  include: 

a.  Improper  assignment  of  responsibility. 

b.  Creation  of  an  improper  climate  of  motivation. 

c.  Inadequate  provisions  for  training  and  education. 

d.  Poor  provisions  for  providing  suitable  equipment  and 
supplies . 

e.  Improper  procedures  for  selection  and  assignment  of 
personnel . 

f.  Improper  allocation  of  funds. 


Adding  Management  Error 


We  need  not  stop  in  our  discussion  of  caus 
terns  defect.  We  can  ask,  "What  causes  sys 
answer  is  management  errors,  because  manag 
who  design  systems. 


ation  with  the  sys¬ 
tems  defects?"  The 
ers  are  the  people 


r 
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The  Safety  Program's  Role 


In  organizations  without  a  safety  staff,  the  buck  stops  with  the  manager. 
However,  if  the  organization  has  a  safety  staff,  we  can  answer  the  question 
"Why  did  the  manager  make  the  error?"  by  answering,  "Probably  because  he 
was  poorly  supported  by  the  safety  program  responsible  for  advising  him 
on  safety  matters."  We  can  further  conclude  that  when  safety  programs 
are  weak  and  ineffective,  it  is  generally  because  safety  managers  make 


Safety  Management  Error.  A  weakness 
in  the  knowledge  or  motivation  of  the 
safety  manager  that  permits  a  pre¬ 
ventable  defect  in  the  safety  program 
to  exist. 

Safety  Program  Defect.  A  defect  in 
some  aspect  of  the  safety  program 
that  allows  an  avoidable  management 
error  to  exist.  Examples: 

1.  Ineffective  information  collection 

2.  Weak  causation  analysis 

3.  Poor  countermeasures 

4.  Inadequate  control 


FIGURE  7 
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Countermeasure  Potential 


The  Department  of  the  Army  causation  approach  opens  eight  avenues 
through  which  we  can  initiate  countermeasures.  None  of  these  areas 
overlap  and  they  open  so  many  effective  countermeasures  to  the  safety 
manager  that  a  major  problem  becomes  selecting  the  best  total 
combination  consistent  with  available  resources. 
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FIGURE  8 

DEPARTMENT  OF  ARMy  CAUSATION  MODEL  VERSUS  HEINRICH'S 

1.  Department  of  Army  model  stresses  the  variability  of  result,  Heinrich's 
doesn't. 

2.  Department  of  Army  model  identifies  the  possibility,  not  inevitability 
of  the  accident  or  mishap. 

3.  Department  of  Army  model  stresses  the  identity  of  unsafe  acts  and  unsafe 
conditions ,  calling  both  OPERATING  ERROR. 

4.  Department  of  Army  model  identifies  the  system  origin  of  operating 
errors,  an  aspect  totally  overlooked  in  Heinrich's  model. 
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5«  Department  of  Army  model  establishes  the  staff  role  of  the  safety 
manager  and  recognizes  his  responsibility  to  line  management. 

6.  Department  of  Army  model  opens  eight  points  of  attack  compared  to 
Heinrich's  two. 

7.  Department  of  Army  model  provides  channels  for  countermeasures  activity 
that  produce  substantial  system  benefits  in  morale,  efficiency,  and 
productivity,  in  addition  to  improved  accident  prevention. 

CONCLUSIONS 

Given  enough  data  the  outcome  of  a  mishap  is  not  chance,  but  is 
predictable. 

2.  All  mishaps  result  from  hazardous  situations  created  by  operating  errors, 
all  of  which  involve  the  acts  of  people.  Thus  all  unsafe  acts  are  committed 
by  people  and  all  unsafe  conditions  are  created  by  acts  of  people.  Unsafe 
acts  create  unsafe  conditions  and  unsafe  conditions  permit  unsafe  acts. 

3.  Operating  errors  are  caused  by  two  factors.  Personality  defects  of 
people  about  which  we  can  do  very  little  in  practical  terms,  and  systems 
defects  which  we  can  do  a  great  deal  about. 

4.  Systems  defects  arise  because  systems  designers  (i.e.,  line  management) 
don't  have  the  expertise  to  avoid  making  management  errors.  That  is  why 
they  hire  safety  staff. 

5.  Safety  staff  exists  for  one  reason  only,  to  advise  line  management  on 
the  design  and  operation  of  a  safety  system, 

6.  It  follows  that  more  management  errors  resulting  in  preventable  losses 
are  made  because  the  safety  program  was  ineffective  in  providing  advice  to 
line  management. 

MOST  PREVENTABLE  ACCIDENTS  ARE  THE  MORAL  RESPONSIBILITY  OF  THE  SAFETY  MANAGER 

AND  ARE  MONUMENTS  TO  HIS  FAILURES. 

7.  In  summary,  the  safety  manager's  sole  job  is  designing  a  safety  system 
the  sole  output  of  which  is  advising  management  on  ways  to  eliminate  the 
causes  of  operating  errors.  Not  how  to  eliminate  accidents,  not  how  to 
eliminate  operating  errors,  but  rather  how  to  eliminate  the  management 
rooted  causes  of  operating  errors.  Our  new  causation  model  is  fully 
consistent  with,  and  supports,  this  approach. 
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4.  VIEWING  AN  ORGANIZATION  AS  A  SYSTEM.  A  system  is  simply 
a  group  of  interrelated  parts  which,  when  working  together 
as  they  were  designed  to  do,  accomplish  a  goal — movement  from 
one  place  to  another.  There  are,  of  course,  many  subsystems 
within  a  total  system;  as  in  the  car,  there  is  the  braking 
subsystem,  the  ignition  subsystem,  and  so  forth.  If  any  one 
of  these  subsystems  within  the  total  system  of  the  automobile 
malfunctions,  the  goal  or  mission  of  the  total  system  is 
subverted — the  car  will  not  run  properly. 

a.  Using  the  same  analogy,  an  installation  or  organiza¬ 
tion  can  be  viewed  as  a  system.  Like  an  automobile,  an 
installation  is  a  group  of  interrelated  parts  and,  again  like 
an  automobile,  it  has  a  goal  or  mission. 


FIGURE  9 

b.  As  you  can  see  in  figure  S,  an  installation  has  an 
input  of  "resources,"  which  is  all  the  people,  money,  and 
material  an  installation  commander  has  at  his  dispoal.  An 
installation  also  has  output-, -the  goal  or  mission  tb  be  accom- 
lished  by  that  installation  commander  with  the  resources  he 
has.  All  installations  have  this  input  and  output  aspect; 
with  a  given  amount  of  resources,  an  installation  commander 

is  to  accomplish  a  given  mission. 

c.  To  take  a  more  in-depth  look  at  the  idea  of  an  instal¬ 
lation  as  a  system,  let's  suppose  that  General  Smith  has  just 
taken  command  at  Fort  X.  General  Smith  has  been  given  a  mis¬ 
sion  to  accomplish,  and  depending  on  the  installation,  it  may 
be  a  certain  number  of  combat  soldiers  trained  per  year,  It 
may  be  so  many  units  of  ammunition  manufactured  per  month,  or 
it  may  be  some  other  mission;  but  General  Smith  knows  before 
he  actually  arrives  at  Fort  X  what  it  is  he  is  to  accomplish 
with  his  new  command.  This  mission  is  the  output  when  viewing 
Fort  X  as  a  system.  When  General  Smith  arrives  at  Fort  X, 

he  will  want  to  know  how  much  money  he  is  to  be  allowed  to  spend 
to  perform  his  mission,  how  many  people  he  may  have  to  accom¬ 
plish  his  mission,  and  what  material  the  Fort  now  has  with 
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which  to  reach  his  goal  of  mission  accomplishment.  In  other 
words.  General  Smith  will  need  to  know  what  input  he  has 
into  the  installation  or  system  in  order  to  successfully 
arrive  at  the  output  of  mission  accomplishment.  With  these 
two  sets  of  information,  General  Smith  is  ready  to  design  his 
resources  into  what  he  believes  is  the  best,  most  efficient 
way  to  reach  his  goal. 

d.  Therein  lies  a  commander’s  responsibility — to  take 
what  he  has  and  design  it  so  that  he  most  efficiently  and 
economically  accomplishes  his  mission.  The  words  efficient 
and  economic  are  keywords  in  a  commander's  task.  A  child 
can  accomplish  the  mission  of  an  installation  if  given  un¬ 
limited  resources  and  time,  but  a  child  probably  cannot  accom¬ 
plish  the  same  mission  efficiently  and  economically. 

5.  THE  US  ARMY  INSTITUTE  OF  ADMINISTRATION  (USAIA)  SYSTEMS 
MODEL.  Since  the  design  of  the  system  is  so  important  in 
efficiently  and  economically  accomplishing  the  mission,  the 
USAIA  System  Model  shown  below  (figure  10)  gives  a  more  de¬ 
tailed  look  at  the  arrangement  of  the  parts. 

a.  The  first  thing  to  be  determined  when  designing  an 
installation  to  perform  a  total  mission  is  to  decide  what 
"TASKS"  need  to  be  done.  The  Army  or  any  other  organiza¬ 
tion  designs  its  installation  or  business  in  this  manner, 
a  list  of  duties  or  tasks  are  determined ,  all  of  which  are 
necessary  to  accomplish  the  overall  mission.  Next,  a  per¬ 
son  or  "MAN"  is  hired  to  accomplish  each  of  the  tasks  de¬ 
cided  upon.  The  person  hired  has  to  posse©  certain  skills 
or  abilities,  those  which  are  considered  important  to  suc¬ 
cessfully  perform  the  task  for  which  he  was  hired.  But, 
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after  hiring  the  person,  it  is  usually  necessary  to  give  the 
employee  additional  "TRAINING"  so  that  he  knows  not  only 
general  duties  but  those  that  are  specific  to  " this - j ob- in- 
this-place . "  Once  the  person  has  been  trained  to  perform 
his  specific  job,  he  is  placed  in  the  "ENVIRONMENT"  in  which 
he  is  to  do  the  job  and  given  the  "MATERIEL"  necessary  for 
him  to  perform. 

b.  When  an  installation,  or  any  organization,  is  thus  viewed 
as  a  system,  it  is  easy  to  see  that  something  may  go  wrong  in 
the  design  of  that  system.  For  instance,  perhaps  the  "TASK" 
originally  was  designed  poorly,  perhaps  the  demands  on  the 
person  to  perform  the  task  are  in  error  or  the  time  given  the 

person  in  which  to  perform  the  task  is  inadequate.  Or,  per¬ 

haps  the  way  the  task  is  arranged  makes  it  difficult  for  any 
person,  no  matter  how  well  trained,  to  perform  it.  It  is 

easy  to  see  that  sometimes  an  error  or  defect  can  erroneously 

be  built  into  a  job,  thereby  making  it  difficult  to  perform 
at  all,  let  alone  perform  safely. 

c.  Other  sections  of  the  systems  model  can  also  develop 
defects.  The  "PERSON"  selected  for  the  task  can,  perhaps, 
be  mentally,  physically,  or  emotionally  unable  to  perform 
the  task.  Or,  the  person  may  not  be  motivated,  either  posi¬ 
tively  or  negatively,  to  do  the  job  for  which  he  was  hired. 
Another  problem  which  sometimes  occurs,  probably  more  fre¬ 
quently  with  military  personnel,  is  that  of  retention.  A 
young  military  officer  is  assigned  for  a  brief  time  to  a 
particular  job  and  before  he  can  learn  it  well,  he  is  ro¬ 
tated  to  another  position.  All  of  these  problems  can  and 
sometimes  do  create  defects  in  the  efficient  and  economic 
design  of  the  system. 

d.  Several  defects  that  creep  into  the  "TRAINING"  aspect 
of  the  system  are:  the  wrong  type  of  training  was  given  the 
person,  perhaps  the  employee  was  given  initial  training  but 
did  not  receive  the  update  training  required  to  keep  him  at 
the  top  level  of  proficiency,  or,  perhaps  he  did  not  quite 
reach  the  proficiency  needed  in  the  initial  training  and,} 
therefore, should  have  received  remedial  training.  Sometimes 
the  training  itself  was  excellent  but  it  was  aimed  at  the 
wrong  group,  the  supervisors  were  trained  when  it  should  have 
been  operating  personnel,  or  perhaps  both  supervisors  and  op¬ 
erators  were  trained,  but  managers  were  not  and  should  have 
been.  Another  problem  with  training  is  the  quality  versus 
quantity  aspect.  It  sometimes  happens  that  the  quality  of 
training  was  excellent  but  it  was  too  short  or  too  long  to 
bring  the  trainees  to  the  level  of  proficiency  needed.  Even 
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assuming,  for  the  moment,  that  the  "TASK"  was  well  designed 
and  that  the  "PERSON"  selected  to  perform  the  task  was  an  ex¬ 
cellent  choice,  these  errors  in  training  the  employee  can 
lead  to  defects  in  the  system/installation  which  can  cause 
losses  of  one  kind  or  another. 

e.  Defects  can  also  occur  in  the  "ENVIRONMENT"  aspect 
of  the  system  design.  Perhaps  the  lighting  or  ventilation 
is  inadequate  when  performing  a  task,  or  the  noise  level  is 
too  high.  Sometimes  weather  is  a  big  factor  when  doing  a  job 
and  the  employee  can  do  his  job  beautifully  in  one  climate, 
but  cannot  do  it  at  all  in  another.  The  way  the  installation 
grounds  and  facilities  were  originally  built  or  laid  out  can 
sometimes  make  it  extremely  difficult  for  an  employee  to 

do  his  job  in  an  efficient,  safe  manner.  These  problems, 
and  others  you  may  think  of,  create  defects  in  the  installa¬ 
tion/  system. 

f.  A  big  problem  area  within  the  system  is  frequently 
that  of  "MATERIEL."  The  supplies  and  equipment  given  the 
person  to  perform  his  task  are  sometimes  poorly  designed 
or,  even  more  often,  poorly  maintained.  In  order  to  do  a 
job  well,  an  employee  must  be  given  properly  designed  and 
maintained  equipment  and  supplies,  but  all  too  frequently, 
because  of  budget  restrictions,  or  other  reasons,  he  is  not. 
Then,  a  defect  exists  in  the  "MATERIEL"  aspect  of  the  system. 

6.  SYSTEMS  DEFECTS  IN  ACCIDENT  CAUSATION.  Let's  take 
another  look  at  the  Institute  Causation  Model  to  reexamine 
exactly  how  the  system  defect  concept  fits  into  accident 
causation . 

a.  Under  the  Heinrich  causation  model,  unsafe  acts/ 
conditions  were  given  as  the  only  explanation  for  acci¬ 
dents;  therefore,  the  only  corrective  action  open  to  the 
safety  professional  was  a  kind  of  scurrying  about  trying 
to  correct  unsafe  conditions  and  conducting  publicity  cam 
paigns  against  specific  unsafe  acts.  However,  now  look  at 
the  tremendous  leverage  the  safety  professional  has!  Instead 
of  spotting  individual  trees  ("This  operator  should  wear 
goggles,"  "This  machines  needs  a  guard,"  "That  operator 
should  have  some  training  before  being  changed  to  a  new 
machine,"  etc.),  now  the  safety  manager  can  look  at  the  en¬ 
tire  forest  to  see  problems.  Not  only  does  this  perspective 
increase  the  effectiveness  of  any  safety  measures  he  designs, 
it  also  places  him  squarely  on  the  management  team.  Manage 
ment  level  persons  look  at  broad  objectives  and  goals,  prob¬ 
lems  and  procedures;  consequently,  when  the  safety  professions 
stops  fighting  individual  problems  and  starts  managing,  by  look¬ 
ing  at  a  broader  spectrum  of  the  organization,  he  becomes  a 
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safety  manager .  One  of  the  big  complaints  among  safety  pro¬ 
fessionals  in  the  past  has  been  that  the  commander  (or  presi¬ 
dent  in  private  industry)  didn't  listen  to  them.  Well,  of 
course  he  didn't  —  he  was  viewing  his  organization  as  a  sys¬ 
tem,  a  set  of  interrelated  parts,  a  broad  whole,  and  too 
often  the  safety  professional  was  talking  with  him  about 
individual  circumstances.  ("Sir,  I  can't  get  guys  in  the 
Facilities  Engineers  to  wear  safety  goggles  when  they're 
drilling  in  cement.")  As  you  can  see,  that  is  not  a  manage¬ 
ment  level  problem;  and  so  the  safety  man  was  viewed  as  an 
irritant  to  the  commander,  not  a  helpful  member  of  the  manage¬ 
ment  team. 

b.  Systems  defects,  then,  are  weaknesses  in  the  way  the 

system  was  designed  or  is  operated.  Some  typical  examples 
of  systems  defects  are:  improper  assignment  of  responsibi¬ 

lity;  creation  of  an  improper  climate  of  motivation;  inad¬ 
equate  provisions  for  training  and  education  of  personnel; 
poor  provisions  for  providing  suitable  equipment  and  supplies; 
improper  procedures  for  selection  and  assignment  of  personnel; 
or,  improper  allocation  of  funds. 

c.  Now  that  we've  established  that  some  accidents  might 
very  well  be  caused  by  operating  error  (or  unsafe  acts/ 
conditions),  but  that  many  mishaps  occur  because  there  are 
defects  or  errors  built  into  the  system/organization,  and 
that  these  defects  lead  not  only  to  mishaps  but  also  to 
other  inefficiencies  within  the  organization,  let's  go  on 

to  the  next  steps  in  the  causation  model. 

d.  The  next  question  is  "What  causes  systems  defects?" 

If  the  system/organization  was  poorly  designed  or  is  improp¬ 
erly  operated,  why  is  it  that  way?  The  answer,  of  course, 
is  people.  The  people  who  originally  designed  the  system 

or  are  now  operating  it--in  other  words,  the  managers  of 
the  organization — goofed  I  The  reason  why  a  system  defect 
exists  is  because  of  an  error  on  the  part  of  a  manager.  For 
some  reason,  the  commander  who  designed  his  input-to-produce- 
his-output  made  an  error,  or  some  other  member  of  the  manage¬ 
ment  team  made  a  mistake  in  the  way  he  designed  his  area  of 
responsibility  and  therefore  a  defect  crept  into  the  system. 
Perhaps  the  original  design  was  excellent  but,  for  whatever 
reason,  the  way  the  subsystem  is  operated  is  faulty,  and 
once  again,  systems  defects  exist.  There  are  any  number  of 
reasons  why  management  errors  come  about.  The  manager  was 
simply  incapable  of  designing  or  operating  an  effective  sys¬ 
tem;  although  we  don't  like  to  admit  it,  there  are  instances 
of  persons  being  put  into  management  positions  who  should 
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never  have  been  allowed  to  manage — they  are  simply  incompe 
tent!  A  person  who  is  in  over  his  managerial  head  cannot 
design  or  operate  an  efficient  system.  Another  reason  might 
be  that  the  person  lacked  knowledge  or  training?  he  has  the 
ability  but  again,  he  is  in  over  his  managerial  head  because 
of  lack  of  experience.  Another  reason,  frequently _ overlooked , 
is  that  the  manager  is  not  motivated  to  either  design  or  op¬ 
erate  an  efficient  system.  Unfortunately,  some  managers 
have  reached  the  stage  of  on- the- j ob -r et i remen t— they | re  on 
the  job  physically  but  mentally  they  have  already  retired. 

They  are  putting  in  time  until  they  can  really  retire;  in 
the  meantime,  they  are  neither  interested  in  nor  enthusiastic ^ 
about  doing  any  job.  But,  whatever  the  reason  for  the  manager  s 
error,  that  error  does  allow  a  systems  defect  to  develop. 


e  To  take  a  look  at  "where-we-are"  in  the  Institute 
Accident  Causation  Sequence,  a  "RESULT,”  whether  major  or 
minor,  is  caused  by  a  "MISHAP"  which  is  almost  always  caused 
by  an  "OPERATING  ERROR,"  but  "OPERATING  ERRORS"  are  frequently 
caused  by  a  "SYSTEMS  DEFECT,"  an  error  in  the  organization 
which  has  developed  because  some  manager  goofed--a  MANAGE¬ 
MENT  ERROR."  In  organizations  without  a  safety  staff,  the 
answer  to  the  question  "Why  did  the  manager  make  the  error? 
could  be  "He  may  have  been  poorly  supported  by  the  safety  pro¬ 
gram."  And,  it's  only  a  hop-skip- and- j ump  to  the  next  ques¬ 
tion  and  answer.  He  was  poorly  supported  by  the  safety  program 
because  the  safety  program  was  inadequately  designed  to  aid  ^ 
him,  and  who  designed  the  safety  program?  Correct-  the  safety 
professional . 

f.  Now  we  can  trace  the  accident  causation  model  from 
left  to  right.  Because  the  safety  manager  goofed  in  design¬ 
ing  an  effect  program  (SAFETY  MANAGEMENT  ERROR)  a  SAFETY 
PROGRAM  DEFECT  developed.  Because  there  was  a  defect  in  t  e 
safety  program,  a  manager  made  an  error  in  either  designing 
or  operating  his  system  (MANAGEMENT  ERROR)  and  therefore 
allowed  a  SYSTEMS  DEFECT  to  creep  into  his 

bility.  The  system  defect,  in  turn,  led  to  OPERATING  ERRORS 
and  these  operating  errors  allowed  the  possibility  of  MISHAPS 
to  occur.  And,  the  mishaps  which  did  occur  led  to  th 
RESULT,  whether  major  or  minor- 

e.  At  first  reading,  this  may  well  sound  like  the  "For 
want  of  a  nail  the  kingdom  was  lost"  sequence  and  perhaps  it 
is;  but  upon  reflection,  it  is  possible  to  see  that  the  ns 
tute  Causation  Model  opens  eight  avenues  through  which  to 
initiate  countermeasures,  instead  of  the  one  area 
under  the  Heinrich  Model.  In  fact,  there  may  now  be  *o  many 
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effective  countermeasures  open  for  the  safety  manager  that  a 
major  problem  becomes  selecting  the  best  total  combinations 
consistent  with  available  resources.  This  problem  of  designing 
an  effective  countermeasures  program  is  discussed  in  detail 
els  ewhe  r e . 


Section  III.  THE  SAFETY  MANAGERS  ROLE 

7.  SAFETY  PROFESSIONAL  TASKS.  A  safety  professional  who  is 
basing  his  corrective  actions  on  the  two  previous  concepts 
described--The  USAIA  Accident  Causation  Model  (figure  10)  and 
the  Systems  Model  (figure  §)  of  an  installation — is  going  to 
be  doing  things  much  differently  than  the  safety  person  who 
tries  to  get  individual  unsafe  acts/unsafe  conditions  cor¬ 
rected.  Number  one,  he  will  have  to  be  more  of  a  manager  and 
much  less  of  a  doer  and,  number  two,  he  will  not  be  designing 
and  initiating  the  same  types  of  corrective  actions.  In  order 
to  fully  understand  the  new  role  of  the  safety  manager,  the 
Institute  has  designed  a  model  which  depicts  what  the  safety 
manager  does  during  his  f orty-hours-plus  of  working  time  per 
week  (figure  11). 


FIGURE  11 
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8.  INFORMATION  COLLECTING.  In  order  to  effectively  design 
and  operate  a  safety  program,  the  safety  manager,  like  other 
managers,  must  know  what  is  happening  throughout _ the _ organi¬ 
zation.  (A  retired  general  once  confided  that  his  biggest 
headache  while  serving  as  a  commander  was  trying  to  find  out 
what  was  really  going  on;  so  many  people,  he  said,  tell  a 
commander  what  they  think  he  wants  to  hear,  not  what  he  needs 
to  know.)  A  good  safety  manager,  probably  more  than  any 
other  person  on  the  staff,  needs  to  know  what  is  happening 
throughout  the  organization.  Other  staff  personnel  need  to 
know  only  what  is  happening  within  their  own  area  of  respon¬ 
sibility  but  the  safety  manager's  area  of  responsibility  i_s 
the  entire  installation;  therefore,  his  area  of  knowledge  must 
be  extensive.  In  other  words,  he  must  have  a  very  good  infor¬ 
mation  collection  system;  he  must  design  and  manage  a  system 
whereby  he  knows  what  has  happened,  what  is  happening,  and 
what  can  reasonably  be  expected  to  happen  in  the  future. 


9.  ANALYSIS.  Raw  information  is  of  no  value.  The  informa 
tion  gathered,  no  matter  how  extensive  that  gathering  has 
been,  is  useless  unless  it  is  correlated  and  analyzed  into 
intelligent  groups  of  relevant  data.  The  second  major  task 
of  the  safety  manager  is  termed  causation  analysis,  looking 
for  trends  and  patterns  among  raw  information  in  order  to 
design  the  best  countermeasures  possible. 


10.  COUNTERMEASURES.  There  are  sometimes  so  many  counter¬ 
measures  possible  to  combat  specific  safety  problems,  that 
it  becomes  a  major  managerial  task  of  the  safety  manager  to 
pick  those  which  are  more  effective  and  most  economic,  those 
that  give  the  most  return  for  the  investment  of  time  and 
money.  Designing  and  putting  into  effect  good  countermea¬ 
sures  for  problems  in  the  in s t a 1 la t ion / sys t em  is  a  major 
component  in  the  safety  manager's  time. 


11.  HORIZONTAL  IMPLEMENTATION.  Putting  countermeasures  into 
effect  leads  to  the  next  major  task  of  the  safety  manager-- 
the  horizontal  implementation  of  those  countermeasures .  The 
Army  Safety  Program  is  designed  to  be  operated  horizontally; 
i.e.,  each  manager  on  the  staff  is  responsible  for  the  safety 
and  well-being  of  resources  within  his  own  area  of  responsi 
bility.  Although  there  is  a  full-time  safety  expert  on  t  e 
staff,  he  usually  does  not  have  directive  authority  throug 
out  the  organization.  He  is  an  advisor  to  the  commander  and 
to  other  staff  elements  on  how  best  to  design  either  the 
entire  sys tern/ ins t all a t ion  or  different  sections  of  the  sys 
tern  in  order  to  meet  safety  requirements.  Consequently,  an 
important  task  of  the  safety  manager  is  getting  things  done 
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through  other  staff  elements,  serving  as  an  expert  advisor  on 
technical  safety  matters  to  other  staff  personnel  who, 
presumably,  have  the  expertise  necessary  to  design  their  area 
of  responsibility  so  that  the  safety  and  well-being  of  all 
their  resources  are  adequately  covered.  It  is  possible  tc 
fall  flat  on  your  safety  managerial  face  here.  A  safety 
manager  may  have  excellent  information  collection  and  ana¬ 
lysis  systems  and  may  be  able  to  design  the  most  effective 
and  efficient  countermeasures  possible,  but  if  he  cannot 
sell  other  managers  on  his  plans,  he  is  totally  ineffective 
and  loses  control  of  his  entire  program. 

12.  MANAGING  THE  PROGRAM.  The  tasks  of  a  safety  manager 
fall  into  one  of  the  categories  discussed  above  during  his 
f orty-hours -plus  each  week.  He  is  collecting  or  analyzing 
information,  designing  countermeasure  programs,  getting  the 
countermeasure  programs  into  effect  through  other  staff 
members,  or  he  is  controlling  his  program  and  assessing  how 
it  is  going  and  what  is  needs.  In  other  words,  he  is  manag¬ 
ing  ,  not  conducting,  a  safety  program. 

Section  IV.  SUMMARY  AND  CONCLUSION 

13.  SUMMARY.  The  material  presented  through  the  rest  of 
this  publication  will  be  based  on  the  concepts  presented 
here.  The  concept  of  viewing  an  organization  as  a  system; 
the  US  Army  Institute  of  Administration  Accident  Causation 
Model  which  introduces  the  concept  of  systems  defects  and 
management  errors;  and  the  concept  of  the  role  of  the  safety 
professional  as  a  designer  and  manager  of  a  safety  program, 

■1  "get-things-doner ,  "  not  "a  doer."  Some  key  points  are: 

a.  Mishaps  result  from  hazardous  situations  created  by 
operating  errors. 

b.  Operating  errors  are  caused  by  two  f actors--person- 
ality  defects  of  people  caused  by  their  social  environment 
and  ancestry,  about  which  we  can  do  very  little;  and  systems 
defects,  about  which  we  can  do  a  great  deal. 

c.  Systems  defects  develop  because  the  system  designers 
(managers)  made  errors  in  the  design  or  operation  of  the  sub¬ 
system  for  which  they  have  responsibility. 

d.  The  duty  of  the  safety  manager  and  his  staff  is  to 
advise  managers  on  the  design  and  operation  of  safety  aspects 
within  the  system  for  which  the  managers  are  responsible. 
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e.  The  actual  day-to-day  duties  of  an  installation  safety 
manager  fall  into  one  of  the  following  categories:  Collecting 

information,  analyzing  information  into  meaningfull  data,  de 
signing  effective  countermeasure  programs,  putting  those  coun¬ 
termeasures  into  effect  through  horizontal  implementation, 
and  controlling  the  safety  program  by  managing  it  and  seeing 
its  weaknesses. 

14.  CONCLUSION.  In  conclusion,  the  safety  manager  should 
view  his  organization  or  command  as  a  system  of  interrelated 
parts  and  should  design  a  safety  program  which  advises  manage¬ 
ment  on  ways  to  prevent  or  eliminate  the  defects  within  the . 
system  which  cause  operating  errors.  The  safety  manager's  job 
is  not  to  eliminate  accidents,  not  to  eliminate  operating  errors, 
but  rather  to  eliminate  the  management-rooted  causes  of  operating 
errors.  This  is  indeed  a  new  and  more  viable  designation  of  the 
safety  manager's  responsibility  and  effort. 


21 


APPENDIX  A 


OUTLINE  OF  A  MODEL  SAFETY  PROGRAM 


The  program  outlined  below  is  intended  to  produce  the  six 
contributions  of  which  a  safety  program  is  capable.  In  each 
case  a  goal  state  is  specified,  followed  by  a  brief  task  list¬ 
ing  and  suggested  tactics  for  task  accomplishment. 


MISSION  PROTECTION 

Goal:  Key  missions  have  been  identified  and  the  potential  acci 

dent  threats  to  each  identified.  Control  measures  have 
been  instituted  consistent  with  cost  and  mission  limita¬ 


tions  . 

TASK 

1.  Identify  key  missions 

2.  Identify  potential  accident 
threat  to  key  missions. 

3.  Control  measures. 


TACTIC 

1.  a.  Examine  mission  state¬ 

ment  s  . 

b.  Consult  with  staff 
sections . 

2.  Systems  analysis. 

3.  a.  Hazard  control  plans 

developed . 

b.  Control  measures 
monitored  . 


DAMAGE  CONTROL 


GOAL:  An  efficient  system  for  detection  of  accidental  property 

damage  incidents  is  in  place.  Damage  incidents  are  being 
logged  and  analyzed  for  their  causes.  Notifications  of 
these  causes  are  being  provided  to  responsible  staff  or 
line  sections  and  corrective  action  is  being  monitored . 

TASK  TACTIC 


1 . 

Detection  of  property  damage 
losses . 

1 . 

2407;  DFAE  Work  Order; 
Inspection 

2  . 

Analysis 

2  . 

Logging  and  Analysis 

3  . 

Notification 

3. 

Normal  Staff  Procedures 

4  . 

Monitor  Progress 

4  . 

Project  Review  System 

I 


f 
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LIABILITY  LIMITATION 


GOAL:  Existing  and  potential  legal  vulnerabilities  are  deter¬ 

mined.  Appropriate  1 iab il i ty- r educ ing  measures  are  in 
place  and  are  being  periodically  monitored. 


TASK  '  TACTIC 


1 . 

Identify  areas  of  legal 
vulnerability . 

1. 

Coordinate 

with 

JAG  . 

2  . 

Devise  program  for  each  area 
of  vulnerability. 

2. 

Coordinate 

with 

JAG. 

3. 

Implement  and  control  program. 

3. 

Coordinate 

with 

JAG. 

MANAGEMENT  IMPROVEMENT 

GOAL:  All  data  is  being  systematically  analyzed  to  determine 

the  management  deficiencies  causing  hazards  and  acci¬ 
dents.  When  found  these  management  problems  are  ver¬ 
ified,  documented,  and  presented  to  the  appropriate 
staff  sections.  The  safety  function  is  monitoring 
action  taken  on  the  problems. 

TASK  TACTIC 

1.  Analysis  1.  Use  of  systems  analysis. 

2.  Verification  and  documenta-  2.  Use  of  information  sys- 

tion .  tem • 


3.  Development  of  remedial  sug¬ 
gestions  . 


3.  All  available  resources; 
use  own  and  other  Army 
safety  expertise,  refer¬ 
ences,  etc. 


4.  Communication  with  concerned  4.  Normal  staff  procedures, 

staff  . 

5.  Monitoring  and  controlling.  5.  Measurable  standards 

program.  Special  audits. 
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INJURY  PREVENTION 


GOAL:  Education,  motivation,  and  engineering  countermeasures 


have  been  developed  and 
surable  standards  have  b 
are  being  montiored. 

are 

aen 

being  implemented.  Mea- 
instituted  and  programs 

TASK 

TACTIC 

1 . 

Design  program  in  three 
ma j or  areas . 

1 . 

Evaluate  existing  systems 
and  means  for  reaching  goal 

2. 

Establish  responsibilities 
and  accountability. 

2  . 

Phase  new  programs  into 
existing  structures. 

3. 

Monitor  performance. 

3. 

Set  standards . 

OSHA  COMPLIANCE 


GOAL:  OSHA  requirements  are  identified  and  are  being  coped 

with  on  a  timely,  efficient  basis.  The  compliance  effort 
has  been  integrated  with  major  safety  program  elements 
for  maximum  effect  and  efficiency. 

TASK  TACTIC 


1.  Identify  requirements. 


2.  Build  systems  to  achieve 
compliance . 

3.  Integration  with  existing 
requirements . 


1.  Review  requirements  and  list 
as  tasks . 


2.  Systems  analysis  of  each 
requirement . 

3.  Planned  integration  with 
existing  program. 
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